Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
bpistone
Participant

MAC: Prevent Remote Access VPN client to start on login

Hi, I need to prevent to start the client when I turn on my mac. I've already tried all the proposed solutions found on Google but they are not working.

It's incredible that there is a deamon that boot automatically on the start. Please give me a solution because I have serious problems with other working tools.

I've tried to modify the scripts /Library/LaunchDaemons/com.checkpoint.epc.service.plist and /Library/LaunchAgents/com.checkpoint.eps.gui.plist by putting

<key>RunAtLoad</key>
<false/>

but it doesn't work on mac os Catalina.

 

Please give me a solution! Thank you

0 Kudos
9 Replies
JackPrendergast
Collaborator

I presume you have taken it out of your login options under your User account, right? 

0 Kudos
JackPrendergast
Collaborator

Also, you checked /Library/LaunchAgents ? 

0 Kudos
bpistone
Participant

I checked both /Library/LaunchDaemons/com.checkpoint.epc.service.plist and /Library/LaunchAgents/com.checkpoint.eps.gui.plist

0 Kudos
PhoneBoy
Admin
Admin

Pretty sure it’s the kernel module that’s blocking traffic, not a user process.
This was discussed here: https://community.checkpoint.com/t5/Remote-Access-VPN/MacOS-EPS-Standalone-Client-VPN-client-Block-A...

0 Kudos
_Val_
Admin
Admin

You cannot do that. Some essential client components are loaded with system, not user, permissions. However, you can offload and re-load the client with cpstop.sh and cpstart.sh scripts, ran by sudo. Of course, you should have full admin permissions to do so.

Important: this is highly not recommended, as unloading the client leaves you completely unprotected.

0 Kudos
bpistone
Participant

Hi, I've to use the client for only connecting to a customer vpn. In my opinion, this type of approach is too much aggressive, I should have the possibility to load and unload the client in an easy way.

About the scripts that you mentioned (cpstart.sh nad cpstop.sh), where I can find them?

Really there isn't a more user friendly way to launch the client only when I need?

Thank you.

0 Kudos
_Val_
Admin
Admin

We do not have lightweight VPN only client for Mac, AFAIK. EPS package includes FDE, FW, malware protection, emulation, anti-ransomware, and more. Most of this components require system level access.

You may want to try SNX/Mobile Portal option instead. 

The mentioned scripts and more, they are under Library, Application Support, in the client package folder. If you do not know where it is, you probably should not poke around.

Once more, I emphasise, off-loading and re-loading components is a very bad security practice, and I would urge you not to do that on production machines.


0 Kudos
G_W_Albrecht
Legend
Legend

The Shutdown Client command from the Menu does not help ?

Bildschirmfoto 2020-11-24 um 10.16.26.png

It will unload it until next reboot...

0 Kudos
PhoneBoy
Admin
Admin

As I noted in the thread I linked, the Mac VPN client is intended—and licensed—as a full Endpoint client.
This Desktop Firewall is a mandatory component of this that cannot be removed.
The only other option on the Mac without the firewall is SNX + Mobile Access Blade or to manually run the stop/start script referenced.

0 Kudos